Security audit

Claw Compactor

Security checks across malware telemetry and agentic risk

Overview

This skill has a real token-compression purpose, but it also ships high-impact proxy and automation features that can expose prompts, rewrite workspace files, and run autonomous CLI agents with weak default controls.

Install only if you are comfortable with a stateful compression and memory tool. Run benchmark or dry-run modes first, keep backups before full or auto compression, do not run the proxy on an exposed network without strong auth, avoid USE_CLI_AGENTS unless sandboxed, and treat .env, Redis, memory files, prompt previews, and LLM endpoints as sensitive data paths. VirusTotal was pending and was not used as a negative signal.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (40)

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The dashboard renders `p.promptPreview` for active processes, which exposes fragments of user prompts directly in the UI. In a proxy handling LLM traffic, prompts may contain secrets, credentials, proprietary data, or sensitive user content, so this creates an information disclosure risk for anyone with dashboard access or any compromise of the dashboard origin.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The SSE live stream appends raw model output text into the dashboard, enabling real-time inspection of responses beyond operational telemetry. Model outputs can contain sensitive data echoed from prompts, generated secrets, internal business data, or harmful content, so exposing them in a monitoring panel materially increases data leakage and insider-abuse risk.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The document makes a broad safety claim that every write operation is opt-in, but elsewhere it describes automatic writes such as processed-session tracking and heartbeat-triggered observation runs. This mismatch can mislead users or downstream agents into treating the tool as non-destructive when it may persist state without explicit approval, increasing the risk of unintended file modification in automated workflows.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The script sources a local .env file with Bash's source builtin, which executes arbitrary shell code rather than merely parsing key=value pairs. If an attacker can modify that file or trick a user into running the script in a compromised checkout, they gain code execution in the user's context before the rest of the script runs.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The comments/documentation imply the script only loads environment variables, but the implementation later sources .env as executable shell. That mismatch is security-relevant because maintainers and users may place untrusted content in .env expecting inert configuration, increasing the chance of accidental code execution.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: In dry-run mode, _process_session() still calls _mark_processed(cache_key), which mutates persistent state despite the documented expectation that no writes occur. This can cause real session files to be permanently skipped on later non-dry-run executions, leading to silent data loss or missed ingestion of records the operator believed were only being previewed.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The CLI advertises --dry-run as only detecting channels and converting without ingesting, but the implementation neither performs conversion in dry-run nor preserves a no-side-effect guarantee because it still writes processed-session state. This mismatch is dangerous because operators may trust the flag during testing and unintentionally suppress future real processing of sessions.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The `observe` command reads transcript files from `~/.openclaw/agents/*/sessions/`, which is outside the user-supplied workspace boundary, then writes derived observations into the workspace. This expands the tool's data access scope to potentially sensitive global per-user conversation history without explicit opt-in or strong scoping controls.

Context-Inappropriate Capability

Low

Confidence: 84% confidence
Finding: The benchmark command enumerates global session transcript directories under the user's home directory even though benchmarking workspace compression does not require access to those unrelated files. While it only counts files, it still broadens data visibility beyond the declared workspace scope and may disclose the existence of other agents' session history.

Missing User Warnings

Medium

Confidence: 82% confidence
Finding: The architecture explicitly describes storing original, uncompressed content in a RewindStore and allowing later retrieval through a tool call, but it does not mention user notice, consent, retention limits, access controls, or safeguards against re-exposing sensitive data. In an agent setting, compressed content that appears minimized or summarized can still be fully reconstructed later, which increases privacy and data-handling risk if secrets, personal data, or proprietary material are ingested.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The README advertises workspace-wide commands such as `full`, `compress`, `optimize`, and especially `auto` watch mode, but does not clearly state whether they modify files, caches, or other persisted workspace state. In an agent-skill context, ambiguous operational scope is risky because an automated agent may invoke these commands over a real repository or user workspace assuming they are safe or non-destructive, leading to unintended file changes or persistent data creation.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The trigger list is broad enough to match ordinary user conversation about memory, compression, or token savings, which can cause the skill to auto-activate unexpectedly. In this skill's context, unexpected activation is more dangerous because the documented behavior includes workspace-wide modification and memory-processing actions rather than a harmless read-only operation.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The documentation recommends automatic compression of all workspace files at session start, but does not clearly warn that files may be rewritten or altered across the workspace. Because this skill is positioned for automatic use, the lack of an explicit warning and confirmation path increases the chance of unintended data modification, corruption, or loss of important context.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill instructs users to configure API keys and custom LLM endpoints for Engram processing without warning that conversation content and memory artifacts may be transmitted to external services. In this context, the feature is explicitly designed to process accumulated conversation memory, so missing privacy disclosure materially increases the risk of sensitive data exfiltration to third-party or self-hosted endpoints.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The EngramCompressor sends full conversation content to an OpenAI-compatible proxy over plain HTTP to localhost, with no transport security or user disclosure at the point of transmission. Even though the endpoint is local by default, the code allows base_url reconfiguration and forwards potentially sensitive chat history to another service, which creates a real confidentiality boundary crossing.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The provided backup script includes automated deletion of remote S3 backups based on filename parsing and age, with no dry-run mode, confirmation, versioning guardrail, or retention safety check. In a backup context, destructive cleanup logic is risky because parsing errors, unexpected object names, or clock/date issues can silently delete valid recovery points and weaken disaster recovery posture.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The README advertises an autonomous agent mode and explicitly references capabilities such as SSH, browser, and file access, but it does not prominently warn users that enabling this mode can perform real actions on local or remote systems. In documentation-driven deployments, this omission can lead operators to enable the feature without understanding the risk of data exposure, unintended system modification, or misuse of connected credentials and infrastructure.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The registry persists request-derived metadata to Redis, including a prompt preview, request ID, model, mode, and source. If prompts contain secrets, credentials, personal data, or proprietary content, storing even truncated previews in Redis expands the exposure surface and can lead to sensitive data disclosure through Redis compromise, logs, backups, or unauthorized internal access.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The code intentionally extracts dynamic values such as JWTs, API keys, UUIDs, and timestamps, replaces them in the main prompt, and then appends the original sensitive values verbatim in a hidden tail section. This does not actually protect secrets; it preserves and re-injects them into the final system message, increasing the chance that credentials and identifiers are exposed to the model, logs, downstream tooling, or other consumers of the transformed prompt.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The code explicitly describes workers as full autonomous agents with all tools enabled and `--dangerously-skip-permissions`, meaning untrusted request content can drive a local CLI with broad execution capability. In a network-exposed proxy, this materially increases the chance of destructive filesystem, shell, or network actions without any user approval boundary.

Missing User Warnings

High

Confidence: 99% confidence
Finding: Every CLI invocation forcibly appends `--dangerously-skip-permissions`, so any requester who can reach the completion endpoint can cause the downstream Claude CLI to run with suppressed permission prompts. Because this proxy turns user-supplied messages into agent input, the lack of an approval gate creates a powerful remote code/action execution surface.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: When CLI routers fail, the proxy forwards the original request messages to a fallback API endpoint, including a hard-coded default internal IP target. This can leak sensitive prompts, system instructions, and conversation history to another service without any caller consent or destination validation.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The proxy sends request contents directly to Anthropic using configured credentials whenever token-based direct mode is available, including full message history and optional tool schemas. In environments expecting local-only processing via CLI, this creates an undeclared data egress path and may violate confidentiality assumptions.

Natural-Language Policy Violations

Medium

Confidence: 87% confidence
Finding: The documentation explicitly describes a language-specific normalization step that converts fullwidth Chinese punctuation to halfwidth characters solely for token savings, without any opt-in, scope limits, or warning about semantic and localization effects. In multilingual text, punctuation normalization can alter meaning, readability, formatting expectations, or downstream processing, so presenting it as a default compression rule is a genuine safety and data-integrity concern.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The codebook example shows compression of sensitive-looking values such as a secret token, usernames, internal IPs, and SSH key filenames, and states they are stored in `memory/.codebook.json` without any warning, redaction guidance, or protection requirements. This is dangerous because the codebook becomes a centralized plaintext map of secrets and infrastructure identifiers, increasing the chance of credential leakage, sensitive data retention, and accidental exposure through logs, backups, or repository commits.

VirusTotal

58/58 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec, suspicious.dynamic_code_execution, suspicious.exposed_secret_literal (+2 more)

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: proxy/compression-middleware.mjs:140

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: proxy/server.mjs:628

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/lib/fusion/nexus_model.py:144

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: benchmark/data/sample_04_mixed_long.json:214

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: proxy/server.mjs:533

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: tests/test_fusion_engine.py:108

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: tests/test_quantum_lock.py:73

Potential obfuscated payload detected.

Warn

Code: suspicious.obfuscated_code
Location: tests/test_photon.py:63

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: references/compression-techniques.md:197